Add Host controller with Ironic power management

Implement a controller that watches Host CRs (from osac-operator) and
reconciles spec.online to Ironic power on/off. Filters on
spec.hostManagementClass == "openstack" and syncs status.poweredOn.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: DanNiESh

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "Kubebuilder DevContainer",
-  "image": "golang:1.24",
+  "image": "golang:1.25",
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:2": {},
     "ghcr.io/devcontainers/features/git:1": {}

.github/workflows/lint.yml

@@ -20,4 +20,4 @@ jobs:
       - name: Run linter
         uses: golangci/golangci-lint-action@v8
         with:
-          version: v2.1.0
+          version: v2.7.2

.github/workflows/test-e2e.yml

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.24 AS builder
+FROM golang:1.25 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 

Dockerfile

@@ -185,7 +185,7 @@ CONTROLLER_TOOLS_VERSION ?= v0.18.0
 ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}')
 #ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries (i.e. 1.31)
 ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')
-GOLANGCI_LINT_VERSION ?= v2.1.0
+GOLANGCI_LINT_VERSION ?= v2.7.2
 
 .PHONY: kustomize
 kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.

Makefile

@@ -1,8 +1,131 @@
-# public_template
+# host-management-openstack
 
-Use this repository as the template for public-facing repositories. Please keep the following warning at the top of the repository README:
+Kubernetes controller that manages bare metal nodes via OpenStack Ironic. Watches Host CRs (defined in [osac-operator](https://github.com/DanNiESh/osac-operator)) and reconciles the desired state to Ironic.
 
-> [!WARNING]
-> Be mindful of the content you commit to this repository. Do not commit any
-> material containing Red Hat confidential content, including information about
-> future product development plans.
+## Description
+
+This controller filters Host CRs where `spec.hostManagementClass == "openstack"` and uses `spec.id` as the Ironic node UUID to manage node lifecycle through Ironic.
+
+## Test locally (with Ironic)
+
+Run the host controller on your machine and point it at your Ironic API. You need a Kubernetes API (e.g. a `kind` cluster) so the controller can watch Host CRs; the controller runs locally and talks to Ironic from your local machine.
+
+### 1. Create a kind cluster
+
+```bash
+kind create cluster --name host-mgmt-test
+```
+
+### 2. Install the Host CRD from osac-operator
+
+The Host CR is defined in the [osac-operator](https://github.com/DanNiESh/osac-operator) `host-operator` branch.
+
+```bash
+kubectl apply -f <path-to-osac-operator>/config/crd/bases/osac.openshift.io_hosts.yaml
+```
+
+### 3. Set Ironic URL and token
+
+```bash
+export IRONIC_URL="https://ironic-url"
+export OSAC_AUTH_TOKEN="token"  # e.g. openstack token issue -f value -c id
+export IRONIC_INSECURE=true     # optional, if using self-signed certs
+```
+
+### 4. Run the controller
+
+```bash
+make run
+```
+
+The controller will use `IRONIC_URL` and `OSAC_AUTH_TOKEN` to connect to Ironic.
+
+### 5. Apply a sample Host CR
+
+In another terminal:
+
+```bash
+kubectl apply -f config/samples/v1alpha1_host.yaml
+```
+
+### 6. Verify
+
+```bash
+# Check Host status
+kubectl get host host-sample -n osac-namespace -o yaml
+
+# Watch controller logs for reconciliation
+```
+
+## Getting Started
+
+### Prerequisites
+- go version v1.25.0+
+- docker version 17.03+
+- kubectl version v1.11.3+
+- Access to a Kubernetes v1.11.3+ cluster
+- Access to an OpenStack Ironic endpoint
+
+### To Deploy on the cluster
+**Build and push your image to the location specified by `IMG`:**
+
+```sh
+make docker-build docker-push IMG=<some-registry>/host-management-openstack:tag
+```
+
+**Install the Host CRD (from osac-operator):**
+
+```sh
+kubectl apply -f <path-to-osac-operator>/config/crd/bases/osac.openshift.io_hosts.yaml
+```
+
+**Deploy the Manager to the cluster with the image specified by `IMG`:**
+
+```sh
+make deploy IMG=<some-registry>/host-management-openstack:tag
+```
+
+> **NOTE**: If you encounter RBAC errors, you may need to grant yourself cluster-admin
+privileges or be logged in as admin.
+
+**Create instances of your solution**
+You can apply the samples (examples) from the config/sample:
+
+```sh
+kubectl apply -k config/samples/
+```
+
+### To Uninstall
+**Delete the instances (CRs) from the cluster:**
+
+```sh
+kubectl delete -k config/samples/
+```
+
+**UnDeploy the controller from the cluster:**
+
+```sh
+make undeploy
+```
+
+## Contributing
+
+**NOTE:** Run `make help` for more information on all potential `make` targets
+
+More information can be found via the [Kubebuilder Documentation](https://book.kubebuilder.io/introduction.html)
+
+## License
+
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

README.md

@@ -36,6 +36,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/osac-project/host-management-openstack/internal/controller"
+	"github.com/osac-project/host-management-openstack/pkg/ironic"
+	osacopenshiftiov1alpha1 "github.com/osac-project/osac-operator/api/v1alpha1"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -46,7 +50,7 @@ var (
 
 func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-
+	utilruntime.Must(osacopenshiftiov1alpha1.AddToScheme(scheme))
 	// +kubebuilder:scaffold:scheme
 }
 
@@ -198,6 +202,34 @@ func main() {
 		os.Exit(1)
 	}
 
+	// Ironic client for bare metal power management
+	var ironicClient *ironic.Client
+	if ironicURLStr := os.Getenv("IRONIC_URL"); ironicURLStr != "" {
+		authToken := os.Getenv("OSAC_AUTH_TOKEN")
+		if authToken == "" {
+			setupLog.Error(nil, "OSAC_AUTH_TOKEN required when IRONIC_URL is set")
+			os.Exit(1)
+		}
+		ironicOpts := ironic.ClientOptions{InsecureSkipVerify: os.Getenv("IRONIC_INSECURE") == "true"}
+		var ironicErr error
+		ironicClient, ironicErr = ironic.NewClientWithToken(ironicURLStr, authToken, ironicOpts)
+		if ironicErr != nil {
+			setupLog.Error(ironicErr, "failed to create Ironic client")
+			os.Exit(1)
+		}
+		setupLog.Info("Ironic client configured", "url", ironicURLStr)
+	} else {
+		setupLog.Info("IRONIC_URL not set")
+	}
+
+	if err := (&controller.HostReconciler{
+		Client:       mgr.GetClient(),
+		Scheme:       mgr.GetScheme(),
+		IronicClient: ironicClient,
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "Host")
+		os.Exit(1)
+	}
 	// +kubebuilder:scaffold:builder
 
 	if metricsCertWatcher != nil {

cmd/main.go

@@ -66,6 +66,21 @@ spec:
         image: controller:latest
         name: manager
         ports: []
+        env:
+        - name: IRONIC_URL
+          valueFrom:
+            secretKeyRef:
+              name: ironic-credentials
+              key: url
+              optional: true
+        - name: OSAC_AUTH_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: ironic-credentials
+              key: token
+              optional: true
+        - name: IRONIC_INSECURE
+          value: "false"
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

config/manager/manager.yaml

@@ -9,3 +9,9 @@ rules:
 - apiGroups: [""]
   resources: ["pods"]
   verbs: ["get", "list", "watch"]
+- apiGroups: ["osac.openshift.io"]
+  resources: ["hosts"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["osac.openshift.io"]
+  resources: ["hosts/status"]
+  verbs: ["get", "update", "patch"]

config/rbac/role.yaml

@@ -0,0 +1,16 @@
+apiVersion: osac.openshift.io/v1alpha1
+kind: Host
+metadata:
+  name: host-sample
+  namespace: osac-namespace
+spec:
+  hostClass: fc830
+  id: 519d6b37-13a9-444c-9a2a-bcac8a33dc44
+  name: host-sample
+  hostManagementClass: openstack
+  networkClass: openstack
+  templateID: default_template
+  online: true
+  networkInterfaces:
+    - macAddress: aa:bb:cc:dd:ee:f1
+      network: private-vlan-network